Published on November 11, 2026 · The mitza.es team
On November 10, 2026 Microsoft released its monthly security bulletin. After the record of more than 1,400 flaws in October, this month it goes past a thousand again, with a detail that matters to any office that uses email: the only exploited zero-day is in Outlook. We summarize what is known as of November 11, 2026, cross-checked against BleepingComputer, Krebs on Security, SecurityWeek and SANS ISC.
The essentials in five points
- More than a thousand vulnerabilities fixed: between 1,093 and 1,260 depending on who counts them (we explain why below).
- Only one exploited zero-day: CVE-2026-124194, in Outlook. It is a spoofing flaw that exposes the NTLMv2 hash of whoever opens a crafted message file. Microsoft rates it as moderate severity (CVSS 6.5).
- Between 63 and 68 critical flaws depending on the outlet. According to BleepingComputer, 48 of its 66 are remote code execution.
- Updates for Windows 10 (ESU) and Windows 11 are already available.
- None of the sources we have read mentions other flaws that were already exploited or made public before the patch.
How many flaws there are: why the numbers don't match
As happened in October, each outlet gives a different total. These are the ones we have checked:
- BleepingComputer: 1,235, including 142 Microsoft Edge flaws (Chromium-based). Its count only includes what was published on Tuesday itself and excludes 108 flaws fixed earlier in the month.
- SANS ISC: 1,260, of which 68 are critical and 167 are Chromium flaws that affect Edge.
- SecurityWeek: 1,094: 726 in Windows, 174 in Office, 59 in SQL Server, 53 in development tools, 27 in SharePoint, 20 in Azure and 9 in Exchange.
- Krebs on Security: 1,093, with 63 critical.
The difference seems to lie mostly in how Edge flaws and those fixed before Tuesday are counted. Only BleepingComputer explains its method; the others don't detail theirs, so we can't say so with certainty. For a small business the conclusion doesn't change: it is an enormous volume, and what matters is what to patch first.
The Outlook zero-day: CVE-2026-124194
Microsoft describes it as a spoofing vulnerability: Outlook does not warn the user before a potentially dangerous action. If an attacker gets someone to open a crafted message file, Outlook connects to a network location controlled by the attacker without showing the usual external-content warning and hands over the user's NTLMv2 hash. Microsoft confirms it is already being exploited, and SecurityWeek adds that it had not been made public before the patch existed.
What an NTLMv2 hash is and why it matters
NTLM is a Windows authentication protocol. When your computer identifies itself to another one, it doesn't send the password as is, but a value calculated from it: the hash. In general terms, whoever obtains that value can try to crack the password by testing combinations on their own machine or, in some environments, reuse it to identify themselves to other services. The longer and more unique the password, the harder it is to crack. For this specific case, the sources only talk about the hash leaking, not about what the attacker does afterwards.
How it can (and cannot) be exploited
- The attacker does not need to be authenticated: it is enough to send the file and convince the person to open it.
- The user has to open it. According to Microsoft, the flaw is not triggered just by Outlook's preview pane.
- It requires network connectivity and user interaction, according to Microsoft's description as cited by BleepingComputer.
Who is affected
SecurityWeek cites Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024; Krebs mentions Microsoft 365 Apps for Enterprise and Office editions. No source gives build numbers, so the most practical thing is to check that Office is up to date. If you use Office 2021, you should also review our notice on the end of support for Windows 11 24H2 and Office 2021. The sources do not detail other products, and we have found no alternative measure to the patch.
What to do about this flaw
- Update Office. In Outlook: File → Office Account → Update Options → Update Now. On managed machines, ask your provider to confirm the version.
- Warn your staff not to open unexpected message files or attachments, even if they seem to come from a contact. It is the same rule as with fake messages and forged QR codes.
- Limit outbound connections on the firewall. Blocking SMB traffic (port 445) to the internet is a good general practice; the sources do not detail which protocol this attack uses, so it is a hardening measure and not a substitute for the patch. You'll find the basics in what a firewall is and what a small business needs.
- Use long, unique passwords and turn on two-step verification. You can check the strength of a password with our password checker and create new ones with the generator, both of which run in your browser.
- If you suspect someone opened a strange file, change their password and let your IT provider know.
Other critical flaws worth looking at
Among the critical ones cited by BleepingComputer and SANS ISC, these are the ones most likely to affect an office:
- Identity and mail servers: remote code execution in Active Directory Domain Services (CVE-2026-118146) and in Exchange Server (CVE-2026-118207). If you run your own server, this is a priority.
- Office: three remote code execution flaws in Excel (CVE-2026-118292, CVE-2026-118296 and CVE-2026-118297) and one in Microsoft Defender (CVE-2026-122194).
- Windows: CredSSP (CVE-2026-119962), Windows Deployment Services (CVE-2026-119951), graphics fonts (CVE-2026-119969), TCP/IP (CVE-2026-113859) and LDAP (CVE-2026-119958). SANS recommends not exposing the latter to the internet.
There are more critical flaws in Microsoft's full list; we have not been able to cross-check all of them against independent sources, so here we include only those that appear literally in the BleepingComputer and SANS notes.
Windows 10 and Windows 11: the November updates
Windows 10 (Extended Security Updates, ESU)
Update KB5131096 includes the month's patches and fixes, among other things, a printing error (code 87) when adding printers published in Active Directory. It introduces a change worth knowing about if you use scripts: stricter encoding validation when signing PowerShell scripts, so those with invalid UTF-8 may fail signature validation. BleepingComputer states that Microsoft lists no open known issues. If you are still on Windows 10, review what options you have in Windows 10 ESU: what to do in your small business.
Windows 11
Updates KB5132061 and KB5131087 are mandatory because they include the month's patches. According to BleepingComputer, Microsoft is not aware of any new issues (there are user comments about failures when installing them, unconfirmed). They add improvements such as a more customizable File Explorer context menu and reinstalling WinRE from Windows Update. Two warnings: a warning is added before prompted data protection (DPAPI) operations, whose prompt experience will be retired in April 2027; and, according to SecurityWeek, this is the last monthly patch for the Enterprise and Education editions of Windows 11 23H2.
What to do this week: checklist
- First, what is exploited: update Office and Outlook on all machines (see above).
- Servers: if you have Exchange Server or domain controllers, plan their update now, with a backup beforehand.
- Windows workstations: test the update on one or two machines and roll it out to the rest within a day or two, unless a problem is detected.
- Check that the updates have been applied (Windows and Office version) and note the date and machines.
- If you have machines left without updates, apply the guidelines in our guide to reading an advisory and setting patching deadlines: an exploited flaw is dealt with within 24–48 hours.
- Keep recent, tested backups.
Quick questions
Why does it matter if the flaw is “moderate”?
The score measures technical severity, not whether someone is attacking it. This flaw is already being exploited, and stealing a credential hash can be the first step of a bigger attack. That is why we treat it as urgent.
Do I have to patch all 1,000 flaws?
The monthly updates include all of them. What decides the order is what is exploited, what is exposed to the internet and what affects your servers.
What if my company uses Microsoft 365?
Microsoft 365 apps update themselves, but not always instantly. Check the version and force the update from Outlook if you are not sure.
How we can help at Mitza
We review the Windows and Office versions on all your machines, apply what is urgent first and leave you a record of what was done. See our IT maintenance for small businesses or tell us about your case on the contact page.
Related reading: Chrome's eighth zero-day of 2026 and the September Patch Tuesday.